coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-09-13 14:22:19 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,709 Commits 183 Branches 286 Tags Multiple Licenses 259 MiB
Commit Graph

34709 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Valerio Setti
67050ecbf1 tests: remove duplicate component_test_psa_crypto_config_accel_hash 
Following recent removal for '_reference' and '_use_psa' functions we
ended up having 2 very similar test components named
'component_test_psa_crypto_config_accel_hash', one using 'default'
configuration and the other one using the 'full' one.

Let's keep the 'full' configuration version and get rid of the 'default'
case.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-08-11 16:59:39 +02:00
Valerio Setti
8a97676cb7 tests: configuration-crypto: remove ssl-opt.sh and compat.sh testing from accel components 
'ssl-opt.sh' and 'compat.sh' in accel components were mostly useful back
when the accelerated components were to be compared against the reference
ones to ensure proper test coverage. Now that the reference components
have been removed it doesn't make sense to keep 'ssl-opt.sh' and
'compat.sh' around because they take a lot of simulation time for almost
no benefit. From TLS point of view we can rely on normal 'test_suite_'
testing to be sure that the crypto mechanism works as expected.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-08-06 14:36:08 +02:00
Valerio Setti
73c48eb654 tests: configuration-crypto: remove mentions to USE_PSA_CRYPTO 
Nowadays USE_PSA_CRYPTO is always enabled and there is no way to disable
it. It doesn't give more information to know that we're setting that
build symbol. Remove that.

While at this remove also '_use_psa' from some test component still using
it in the name for the same reason.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-08-06 14:27:54 +02:00
Valerio Setti
6eda95fec1 tests: configuration-crypto: fix comments still referencing reference components 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-08-06 14:01:41 +02:00
Valerio Setti
92cd477ffd tests: scripts: remove _reference test components 
These were useful in the 3.6 days when 'analyze_outcomes.py' was used to
check that driver acceleration was providing the same coverage as the
reference legacy modules. Since this check has recently been removed
from 'analyze_outcomes.py' all the '_reference' component can be
removed as they are just wasting CI time.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-07-30 15:27:46 +02:00
David Horstmann
3bb3738679
Merge pull request #10820 from minosgalanakis/tools/fix-auto-generated-files 
Fix generate_errors.pl
 2026-07-20 09:55:59 +00:00
David Horstmann
12556bc2a2
Merge pull request #10804 from valeriosetti/improve-rsa-pubkey-import-err-code 
pk: improve error code failure reporting when RSA public key parsing fails (1/2)
 2026-07-15 11:09:33 +00:00
Minos Galanakis
32ae7d92d6 Fix generate_errors.pl 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-09 15:20:32 +01:00
Ronald Cron
9e9eb069d6
Merge pull request #10817 from Mbed-TLS/mbedtls-4.2.0_mergeback 
Mbedtls 4.2.0 mergeback
 2026-07-08 13:16:51 +00:00
Minos Galanakis
bacdd16661 Updated framework 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-08 10:44:21 +01:00
Minos Galanakis
53aaf3215b Updated tf-psa-crypto submodule 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-08 10:43:26 +01:00
Valerio Setti
a5b83aea58 tests: x509parse: add temporary fallback mechanism for PK error codes 
Add a temporary fallback mechanism in 'x509parse_crt' while crypto#827
is merged.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-07-07 22:56:30 +02:00
Minos Galanakis
970ccc59b0 Merge tag 'mbedtls-4.2.0' into mbedtls-4.2.0_mergeback 
Mbed TLS 4.2.0

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-07 16:51:57 +01:00
Valerio Setti
8607628249 tests: x509parse: adjust some PK related error codes 
After crypto#827 some PK error codes changed from
MBEDTLS_ERR_PK_INVALID_PUBKEY to MBEDTLS_ERR_PK_INVALID_ALG.
This commit adjusts failing test cases.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-07-02 14:05:15 +02:00
Minos Galanakis
ece41aa84d ChangeLog: Removed CVE-ID 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
mbedtls-4.2.0 v4.2.0 		2026-07-01 12:00:14 +01:00
Valerio Setti
47e9e61020
Merge pull request #10656 from bjwtaylor/unused-variable-ret 
Fix variable set but not used warning
 2026-07-01 08:26:29 +00:00
Minos Galanakis
b4ee2d4277 Update BRANCHES.md 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:16:27 +01:00
Minos Galanakis
c1cc0ed3ed ChangeLog: Removed todo placeholder for CVE 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:16:27 +01:00
Minos Galanakis
7f64d9609b Changelog: Added reference to tf-psa-crypto update 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:16:27 +01:00
Minos Galanakis
f3c2896076 Assemble ChangeLog 
./framework/scripts/assemble_changelog.py

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:12:41 +01:00
Minos Galanakis
b11a07f274 Bump version --version 4.2.0 
./scripts/bump_version.sh --version 4.2.0

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:12:41 +01:00
Minos Galanakis
97a9420455 Updated tf-psa-crypto submodule 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:12:41 +01:00
Minos Galanakis
d156cf4c02 Merge remote-tracking branch 'development-restricted' into mbedtls-4.2.0.rc 2026-06-26 22:23:37 +01:00
Ronald Cron
41a8bdf109
Merge pull request #1619 from valeriosetti/issue1585 
[development] Stale DTLS- SRTP negotiation state after session_reset() (ARM-RZ7EMQAA)
 2026-06-26 12:17:06 +02:00
Ronald Cron
3bb1c69f7e
Merge pull request #1685 from minosgalanakis/security/mlfbyt4c_tls13_policy_bypass_changelog 
Add Attribution CVE mbedtls:development-restricted
 2026-06-25 15:54:46 +02:00
Ronald Cron
05e0dfbe99
Merge pull request #10786 from minosgalanakis/mbedtls-release-sync 
Mbedtls 4.2.0 release sync
 2026-06-25 12:16:45 +00:00
Minos Galanakis
66e3648745 Updated tf-psa-crypto pointer 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-25 00:50:42 +01:00
Minos Galanakis
0aaa58b438 Updated framework pointer 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-25 00:50:26 +01:00
Gilles Peskine
1a4f04b0c4
Merge pull request #10788 from bensze01/readthedocs 
Upgrade readthedocs builder to Ubuntu 26.04
 2026-06-24 18:18:42 +00:00
Gilles Peskine
9baa16385d
Merge pull request #1652 from ronald-cron-arm/hsm-do-not-span-key-change 
Hsm do not span key change
 2026-06-24 19:22:01 +02:00
Bence Szépkúti
98413e8b70 Upgrade readthedocs builder to Ubuntu 26.04 
The 20.04 runner is no longer supported.

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
 2026-06-24 16:43:16 +02:00
Ronald Cron
b188f399f9 Check ServerHello record boundary alignment only in TLS 1.3 case 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
74b9ab2008 tls13_fetch_handshake_msg(): Remove require_record_boundary parameter 
Deduce it from the handshake message type

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
e08cea612f tls13_record_boundary_alignement: Append empty hs msg 
Append an empty handshake message to expand
the record instead of just a zero byte.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
1a58c59470 Various improvements of tls13_(drop_early_data|record_boundary_alignment)() 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
6c557a70f6 tls13: Rework mbedtls_ssl_tls13_fetch_handshake_msg() 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
0c9d3d4a0f tls13: Improve argument name 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
86315b62a8 test_suite_ssl: Add initialization to all zeroes of test endpoint structs 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
c494497256 Fix typos 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
e55d0b76ed Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
2de65b79a3 test_suite_ssl: Test EndOfEarlyData on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
cbef7256ce test_suite_ssl: Test client Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
53ac018b24 test_suite_ssl: Test server Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
93eb43ed4f test_suite_ssl: Test ServerHello on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
c8fefcde05 test_suite_ssl: Test ClientHello on record boundary check 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
3861588b47 tls13: Add record boundary checks 
RFC 8446 (TLS 1.3 specification), Section 5.1, states:

Handshake messages MAY be coalesced into a single TLSPlaintext record
or fragmented across several records, provided that:
    ...
    -Handshake messages MUST NOT span key changes. Implementations
    MUST verify that all messages immediately preceding a key change
    align with a record boundary; if not, then they MUST terminate the
    connection with an "unexpected_message" alert. Because the
    ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate
    messages can immediately precede a key change, implementations
    MUST send these messages in alignment with a record boundary.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
b340e27847 test_suite_ssl: Add early data drop tests 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:30 +02:00
Valerio Setti
4f92a63e4a tests: ssl_helpers: run ssl_context reset check only when the SSL context is setup 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 15:37:00 +02:00
Minos Galanakis
f722436e46 Changelog. Added attribution/CVE for 1569 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-24 14:36:00 +01:00
Ronald Cron
f74ef9b3ab
Merge pull request #1599 from bjwtaylor/ssl-ignores-failure-restricted 
Fix issues in ssl where it ignores the failure return
 2026-06-24 15:02:34 +02:00